Sarbanes-Oxley Practices for Good Corporate Governance
Part of the Sarbanes-Oxley For Dummies Cheat Sheet
Sarbanes-Oxley (SOX) was passed to combat corruption at big public companies like Enron, WorldCom, Tyco, Adelphia, Global TelLink, HealthSouth, and Arthur Andersen. But small and not-for-profit companies are finding they have no choice but to adopt many of the same standards if they want to get insurance, attract investors and donors, and repel lawsuits. SOX compliance is becoming a portfolio building block that no company can ignore. Here’s what to do:
Form an audit committee. Your company’s audit committee should consist of independent directors who sit on the board and ensure the integrity of your company’s audit process. After SOX, it’s tough to explain to investors and regulatory authorities why your company never got around to convening an audit committee.
Combat Section 404 audit-chondria and policy paranoia. Auditors and governance officers want to shine by conscientiously complying with SOX Section 404. However, they have to do their jobs within the bounds of budget and reason. Not every audit issue deserves full-throttle testing, and not every trivial process needs accompanying polices and controls.
Prevent whistle-blower complaints from becoming lawsuits. Every company has its share of complainers and malcontents. However, when employee or vendor complaints regard matters than can affect the company’s financial statements, the issues need to be fully documented and vetted.
Keep a lid on insurance premiums. Increasingly, insurance companies are looking at SOX compliance as an unofficial underwriting criterion in quoting officers’ and directors’ liability policies and other coverage relative to companies’ exposure. Put simply, SOX compliance can save premium dollars.
Be credible in raising capital. No investor or donor wants to assume unnecessary risk. Documenting your company’s compliance with the relevant aspects of SOX shows creditors and donors that your company operates in an ethical, controlled environment and that its future growth is a good bet.
Deal with real data in making decisions. No company can make good decisions if its financial data is speculative and its procedures are hazy. The good news about SOX is that it has created spinoff software tools and checklists to help your CEOs, CFOs, and other management team members get a handle on what’s happening with your company.
Figure out if SAS 70 applies to you (even if the rest of SOX doesn’t). If your company provides services to publicly traded companies, your clients may be asking you for an SAS 70 report. Even if you don’t have to comply with SOX, your customers may have to document that they only outsource to service providers with good internal controls in place and may be looking for you to provide the appropriate SAS 70 documentation.
Communicate about control. When a company experiences a breach of ethics or internal control, it’s important to be able to trace the company communications to see where the breakdown occurred. Clear communications about controls, procedures, and ethics can protect conscientious management and employees at all levels while laying the blame on those attempting to circumvent SOX standards. The SOX spinoff market has produced tools and checklists to test communication as well as other types of control.
Prepare management for new levels of liability. SOX places more responsibility (and potential liability) on management than ever before. Management needs to understand what it can no longer delegate under SOX and develop a strategy for maintaining control over what can be handed off to others.
Adopt a code of ethics, and mean it. Every company should adopt a simple code of ethics and communicate it to everyone in the organization. In any company, new situations that aren’t covered by specific policies will arise. However, in the post-Enron era of SOX, the company’s code of ethics should cover everything.